QUESTION 63An administrator wants to capture ESP traffic between two FortiGates using the built-in sniffer. If the administrator knows that there is no NAT device located between both FortiGates, what command should the administrator execute?

QUESTION 64Which of the following conditions must be met for a static route to be active in the routing table? (Choose three.)

A. The next-hop IP address is up.B. There is no other route, to the same destination, with a higher distance.C. The link health monitor (if configured) is up.D. The next-hop IP address belongs to one of the outgoing interface subnets.E. The outgoing interface is up.

Answer: ABE

QUESTION 65View the exhibit, which contains the partial output of a diagnose command, and then answer the question below.Based on the output, which of the following statements is correct?

QUESTION 66View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.Why didn’t the tunnel come up?

A. The pre-shared keys do not match.B. The remote gateway’s phase 2 configuration does not match the local gateway’s phase 2 configuration.C. The remote gateway’s phase 1 configuration does not match the local gateway’s phase 1 configuration.D. The remote gateway is using aggressive mode and the local gateway is configured to use man mode.

Answer: C

QUESTION 67An administrator has configured two FortiGate devices for an HA cluster. While testing the HA failover, the administrator noticed that some of the switches in the network continue to send traffic to the former primary unit. The administrator decides to enable the setting link-failed-signal to fix the problem. Which statement is correct regarding this command?

A. Forces the former primary device to shut down all its non-heartbeat interfaces for one second while the failover occurs.B. Sends an ARP packet to all connected devices, indicating that the HA virtual MAC address is reachable through a new master after a failover.C. Sends a link failed signal to all connected devices.D. Disables all the non-heartbeat interfaces in all the HA members for two seconds after a failover.

Answer: A

QUESTION 68View these partial outputs from two routing debug commands:Which outbound interface will FortiGate use to route web traffic from internal users to the Internet?

A. Both port1 and port2B. port3C. port1D. port2

Answer: C

QUESTION 69What conditions are required for two FortiGate devices to form an OSPF adjacency? (Choose three.)

QUESTION 70View the exhibit, which contains the output of a debug command, and then answer the question below.Which of the following statements about the exhibit are true? (Choose two.)

A. In the network on port4, two OSPF routers are down.B. Port4 is connected to the OSPF backbone area.C. The local FortiGate’s OSPF router ID is 0.0.0.4D. The local FortiGate has been elected as the OSPF backup designated router.

Answer: BC

QUESTION 71How does FortiManager handle FortiGuard requests from FortiGate devices, when it is configured as a local FDS?

A. FortiManager can download and maintain local copies of FortiGuard databases.B. FortiManager supports only FortiGuard push to managed devices.C. FortiManager will respond to update requests only if they originate from a managed device.D. FortiManager does not support rating requests.

Answer: A

QUESTION 72View the exhibit, which contains the output of a real-time debug, and then answer the question below.Which of the following statements is true regarding this output? (Choose two.)

A. This web request was inspected using the root web filter profile.B. FortiGate found the requested URL in its local cache.C. The requested URL belongs to category ID 52.D. The web request was allowed by FortiGate.

Answer: BC

QUESTION 73What is the purpose of an internal segmentation firewall (ISFW)?

A. It inspects incoming traffic to protect services in the corporate DMZ.B. It is the first line of defense at the network perimeter.C. It splits the network into multiple security segments to minimize the impact of breaches.D. It is an all-in-one security appliance that is placed at remote sites to extend the enterprise network.